1. Field of the Invention
The present invention relates to a method of and apparatus for classifying the types of applications being used on an IP (Internet Protocol) network to calculate a constitution ratio thereof. The present invention also relates to a method of and apparatus for detecting an abnormality in the network on the basis of results of the classification.
2. Description of the Background Art
Conventionally, as a technique for the purpose of cheaply providing probes whose reliability of network abnormality detection is high, Japanese patent laid-open publication No. 2006-148686 discloses an abnormality detector, which includes a traffic measurer measuring traffic routed to a network interface at the measurement intervals determined by an analysis-period determiner, a statistics calculator performing a statistical process at the measurement intervals on the header information analyzed by a packet analyzer, a feature information memory producing and storing at the measurement intervals feature information that contains as feature items the output data of the traffic measurer and statistics calculator, a database storing old feature information in order, and an abnormality detector which reads out, every time new feature information is produced, from the database feature information having its specific feature item equivalent to the new feature information with a certain range of identity, then statistically calculates a normal range for another feature item of the feature information readout, and compares the normal range with the corresponding other feature item of the new feature information, thereby detecting an abnormality.
T. Shizuno, et al., “An Application Identification Method based on Flow Behavior Analysis for an Aggregation of Flows” IEICE Technical Report No. NS2005-160, The Institute of Electronics, Information and Communication Engineers (March 2006), proposes another technique for identifying applications by referring to features for each communication flow.
As disclosed in the above-mentioned Japanese '686 patent publication, when the header information of Layer 4, equivalent to the transmission control protocol (TCP), or lower is used to detect a traffic abnormality, the port number of TCP or UDP (User Datagram Protocol) is being used. This is for the reason that different applications are respectively attached to port numbers. For instance, a hypertext transfer protocol (HTTP) is assigned to TCP port 80, so that it can be easily supposed that many Web applications will use that port number.
Recently, in order to avoid the packet filtering rule and for other reasons, a correct port number may not be utilized. Besides, reserved port numbers having no particular application are often used to utilize relatively new types of applications such as a point-to-point (P2P) application.
For those reasons, nowadays, systems that classify applications according to port numbers or utilize results of the classification are disadvantageous in that the classification results are not able to reflect actual traffic conditions sufficiently.
In addition, as disclosed in the above-mentioned T. Shizuno, et al., in the method of classifying applications for each flow, a vast amount of calculation is required when generally classifying the types of applications. This method also has the disadvantage that not all application types are classified.
In the method, even if an application could be correctly specified, the protocol may not be utilized, as in tunneling communication, for example, according to a predefined rule of utilization.
In such a case, even if an application could be specified, a practical way of utilization could not be specified in the last analysis. As a result, the method has the disadvantage that the significance of specifying applications has been lessened.